TWI601405B - Method and apparatus for cloud-assisted cryptography - Google Patents

Method and apparatus for cloud-assisted cryptography Download PDF

Info

Publication number
TWI601405B
TWI601405B TW104104390A TW104104390A TWI601405B TW I601405 B TWI601405 B TW I601405B TW 104104390 A TW104104390 A TW 104104390A TW 104104390 A TW104104390 A TW 104104390A TW I601405 B TWI601405 B TW I601405B
Authority
TW
Taiwan
Prior art keywords
encrypted
key
symmetric key
consumer device
private key
Prior art date
Application number
TW104104390A
Other languages
Chinese (zh)
Other versions
TW201541923A (en
Inventor
亞歷克斯 奈蕭特
夏隆 奧馬爾 班
尼德M 史密斯
小愛德華V 吉米森
何慕德M 赫斯拉維
Original Assignee
英特爾公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US14/227,319 priority Critical patent/US9503433B2/en
Application filed by 英特爾公司 filed Critical 英特爾公司
Publication of TW201541923A publication Critical patent/TW201541923A/en
Application granted granted Critical
Publication of TWI601405B publication Critical patent/TWI601405B/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/06Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Description

Method and device for cloud assisted cryptography Field of invention

The embodiment relates to cloud assisted cryptography.

Background of the invention

The secure sharing of private keys between computing devices can present challenges due to the need for both secure distribution and secure storage of keys on all devices. One solution is key synchronization between trusted platform modules (TPMs), such as defined by the Trusted Computing Group (TCG), but this solution is often complex, costly, and possibly at all ends. A specific hardware is required at the point. As a result, there is no direct way to consume information protected by public key cryptography on the endpoint without the implementation of a particular hardware and key synchronization method.

Existing hardware security modules (HSMs) can be used by the server platform to manage keys remotely in a secure container that also protects key operations such as encryption and signing. HSM is generally expected to operate at the highest security level because it manages keys for large crowds. Therefore, the security requirements for the safest usage conditions become the minimum security requirements for HSM, which can add significant costs and additional burdens to the deployment lifecycle.

In accordance with an embodiment of the present invention, a system is specifically provided, comprising: a processor comprising: private key decryption logic for decrypting an encrypted private key received from a consumer device and for Generating a private key; and symmetric key decryption logic for receiving the private key from the private key decryption logic and for decrypting one of the encrypted symmetric keys received from the consumer device, wherein the decryption system Implemented using the private key; and a dynamic random access memory (DRAM) coupled to the processor.

100, 200, 800‧‧‧ systems

110‧‧‧ (safe) endpoint device

120, 204, 304, 402, 502‧‧‧ consumer devices

130‧‧‧Generation device

140‧‧‧Cloud Computing Server (CCS)

202‧‧‧User device

203, 210, 324‧‧ ‧ processors

205, 216‧‧‧ Dynamic Random Access Memory (DRAM)

206‧‧‧Cloud Computing Service (CCS)

208‧‧‧temporary nodes

212‧‧‧Private Key Decryption Logic

214‧‧‧symmetric key decryption logic

220‧‧‧Certification Logic

232‧‧‧secure session logic

234‧‧‧Decryption logic

302‧‧‧Content source/user

306‧‧‧Cloud Password Service (CCS)

308‧‧‧Encrypted content files

310, 312‧‧ request

314, 606, 608, 610‧‧‧ hidden private keys

316, 604‧‧‧Concealed symmetric key

318, 320‧‧ ‧ damaged

322‧‧ symmetrical key

326‧‧‧Decrypted Content File

404, 504‧‧‧CCS temporary nodes

406, 506‧‧‧Safe designated address space

408, 410, 508, 510, 512, 514, 522, 524‧ ‧ steps

412, 518‧‧‧Unpacking request

414‧‧‧Send

416‧‧‧ Order

500‧‧‧flow chart

516‧‧‧Check

520‧‧‧Step/Symmetric Key

600‧‧‧Files binary large objects ("blob")

602‧‧‧ (encrypted) ciphertext

612‧‧‧Data security level indicator

614‧‧‧ digital signature/signature key

700‧‧‧ method

705, 710, 720, 730, 740, 750, 760, 770, 780‧‧‧ blocks

810‧‧‧Application Processor

815‧‧‧ storage

820‧‧‧Input/Output System

825‧‧‧Rechargeable power supply

830‧‧‧Baseband processor

840‧‧‧ transceiver

850‧‧‧Antenna

860‧‧‧Integrated Sensor Hub (ISH)

870‧‧‧ sensor

1 is a block diagram of a system in accordance with an embodiment of the present invention.

2 is a block diagram of a system in accordance with another embodiment of the present invention.

3 is a flow chart of a system for use in accordance with an embodiment of the present invention.

4 is a flow diagram of authentication and key decryption in accordance with an embodiment of the present invention.

Figure 5 is a flow diagram of authentication and key decryption in accordance with another embodiment of the present invention.

6 is a block diagram of a file binary large object (blob) in accordance with an embodiment of the present invention.

7 is a flow chart of a method for performing cloud assisted cryptography in accordance with an embodiment of the present invention.

Figure 8 is a block diagram of a system in accordance with another embodiment of the present invention. Figure.

Detailed description

Presenting methods and devices using distributed and cloud-assisted technologies for allowing virtual class TPM performance in the personal computing cloud of the platform (herein "personal cloud" or "cloud"), which borrows The cryptographic function is performed in the cloud on behalf of the other endpoint by performing collaboration between the endpoints of each operation and the personal cloud. Through the use of such technologies, neither the client nor the cloud execution entity can perform the password function individually, and the related private key is not stored in plain text or stored in the endpoint or the cloud execution entity. Operations in the cloud can be performed in a Trusted Execution Enforcement Environment (TEE) with authentication. Authentication ensures that the private key is not exposed outside the personal cloud for a particular password operation.

The tripartite algorithm can be implemented between the key owner, the device requesting the cryptographic operation using the key, and the cloud system performing the cryptographic operation.

Embodiments can be used in many different types of systems. For example, in an embodiment, a communication device (eg, a phone, tablet, laptop, other computing device, etc.) can be configured to perform the various methods and techniques described herein. Note that the scope of the present invention is not limited to communication devices. Other embodiments may be directed to other types of devices for processing instructions. The one or more machine-readable media can include instructions that, in response to execution on a computing device, cause the device to perform one or more of the methods and techniques described herein.

In an embodiment, the private key is secured by the public key of the cloud. Protection. The private key can be encrypted (eg, to form an encrypted private key) so that only the cloud server can use it. In order to use the private key, the endpoint can send the encrypted private key to the cloud server and the private key is not stored on the cloud server, the cloud server can extract the private key and in the trusted execution environment. The extracted private key is temporarily used as a proxy for the endpoint. The extraction of the private key may be conditional on the Trusted Execution Environment (TEE) having met the security enforcement policy, which may be partially established using the server's TEE authentication and user-specified enforcement requirements.

Various client platforms may include TEE components to implement the agreement; therefore, the role of a "server" ("consumer device") that implements temporary operations can be performed by a variety of platforms, including smart phones, tablets, and lightweight devices. Notebooks, desktops, servers, virtualization servers and embedded systems. This flexibility may be advantageous in heterogeneous computing environments where there are platforms that do not have TEE components to implement the agreement and may have various levels of trustworthy computing functionality. The user can continue to use the "weaker" device (eg, a consumer device) to access the strong protected data as long as it has access to some other device (eg, a cloud server) that has The TEE component and can act as a replacement for native TEE performance.

Embodiments of the invention may include trustworthy agent discovery and plan execution agreements for distributed systems including personal cloud/device cluster nodes, which may include virtualized environments. A node with TEE functionality maintains a redundant copy of the data protection and identification key, so it remains highly available. Nodes with less functionality (for example, consumer devices) can be used Sensitive data is manipulated by accessing one of the nodes having the TEE function to perform an encryption/decryption operation at a remote location.

In an embodiment, the trustworthy agent discovery performance identifies a less trustworthy node that can be characterized by a trustworthiness rating. The information organized according to the trustworthiness rating can be matched to a consumer node with a similar trustworthiness rating. For example, a formal trust rating system can be used, for example, Clarke-Wilson, Biba, Take-Gant, Bell-LaPadulla, Graham-Denning, and others.

Embodiments of the present invention may not utilize HSM for transitory nodes, which would add additional cost and complexity. By not storing any user-controlled personal cloud secrets (eg, symmetric keys, private keys, etc.) on the temporary TEE node, the "attack surface" (eg, system weakness) can be reduced. TEE authentication capabilities can be used to discover the suitability of a node to function according to the type of "generating," "temporary," or "consuming" nodes in a personal cloud or distributed system controlled by the user. The key provision can be performed using a rights management policy in which the right to decrypt ("unwind") the key to be provided can be tied to a TEE platform configuration register (PCR) that can describe the current operational state. For example, PCR can be safely presented to the cloud server as evidence of the right to unlock the key.

Node-specific policies can be accompanied by a hidden key file "blob", for example, a binary large object.

According to a policy, the key provided to the temporary node will be deleted after the transaction key operation is completed.

Less trustworthy nodes can be applied to personal clouds under the following conditions Participation in the end/distributed environment without loss of trust:

- The consumer node may have enhanced device identification capabilities but does not have a generic TEE for storing/using data and user authentication keys.

- The consumer node may have a trusted manageability subsystem available to provide a temporary key (eg, daily or hourly), which is then used to authenticate the transient node.

Embodiments may include the following components:

1. A public key infrastructure (PKI) that is capable of generating private/public key pairs.

2. Endpoint devices with appropriate cryptographic hardware, such as Identity Protection Technology (IPT), Trusted Platform Module (TPM), and/or HSM, which can hold their own private keys and The cryptographic operation (e.g., content encryption) can be performed by a known public key, such as belonging to another computer and/or user.

3. A cloud environment that is capable of launching code within the TEE and verifying the integrity of the execution environment (the cloud environment) and the code executed within the cloud environment. This cloud environment is also capable of performing various password operations.

4. Other devices (eg, consumer devices) that want to delegate password operations to the cloud and have associated encrypted private keys in their possessions.

5. The network, which is capable of transferring data and post-data between the endpoint and the cloud service.

6. TEE, which verifies the current configuration and enhancement status of the TEE.

7. A TEE with Platform Configuration Register (PCR) or Virtual Memory Function Command (VM_Func) capable of recording and reporting TEE memory violation events.

8. An agreement for discovering and classifying nodes suitable for participating in a personal cloud model and for performing a key provisioning plan based on the classification.

The PKI can generate a key for the endpoint. Each endpoint having secure storage for the key can receive an individual private key, and each endpoint without secure storage can receive a copy of the individual private key that it has encrypted with the public key of the cloud service.

Generating an endpoint can generate content and can protect the content by generating a random symmetric key. The generating endpoint can then encrypt the content by a random symmetric key. The symmetric key can be encrypted by an individual private key to keep the encrypted symmetric key and content as post-set data. Individual private keys can be encrypted by the public key of the cloud service.

In an embodiment, an endpoint that wants to use encrypted content and has its own private key may send the encrypted content including the encrypted symmetric key and its own encrypted private key to the cloud. So that the cloud can operate on the content on behalf of the endpoint. The cloud (eg, a virtual machine (VM)) can decrypt the encrypted private key (eg, using the decryption key of the cloud's public/private key cryptosystem). By (unencrypted) the private key, the cloud can decrypt the symmetric key and then use the symmetric key to perform actions on behalf of the client (eg, returning the key, performing editing of the file content in the cloud, in the archive content) The file content is executed in the case of executable content, the file is presented for secure remote viewing, etc.).

In another embodiment, another device, such as a consumer device, may wish to access encrypted content that has been encrypted by a symmetric key. Consumer device There are access rights to the encrypted symmetric key (encrypted by the private key) and the encrypted private key (private key encrypted by the Cloud Computing Service Public Key (PKI)). The consumer device can send the encrypted symmetric key and the encrypted private key to the Cloud Computing Service (CCS). The CCS can decrypt the encrypted private key (eg, the decryption key of the PKI using CCS). With the (unencrypted) private key, the cloud can decrypt the encrypted symmetric key and pass the (unencrypted) symmetric key back to the consumer device, which can decrypt the encrypted content. Thus, although the consumer device is not capable of directly decrypting the encrypted symmetric key to decrypt the encrypted content, the CCS can provide the (unwrapped) symmetric key to the consumer device.

1 is a block diagram of a system 100 in accordance with an embodiment of the present invention. System 100 includes (secure) endpoint device 110, consumer device 120 (eg, a cellular or other user interactive device, a tablet smart phone, a lightweight notebook, a desktop computer, a server, a virtual The server, the embedded system, and the like, the generating device 130, and the cloud computing server (CCS) 140.

In operation, the generating device 130 can generate one or more keys. For example, the generating device 130 can generate a (random) symmetric key, a private key, a public encryption key, etc., which can be requested by the endpoint device 110 capable of holding its own private key.

The consumer device 120 can receive from the endpoint device 110 an encrypted file that has been encrypted using a symmetric key. Endpoint device 110 may also send an encrypted symmetric key ("hidden symmetric key") that has been encrypted by the private key received from generating device 130 to consumer device 120 (eg, as an encrypted file) After the case, set the information). The consumer device 120 can also receive an encrypted private key ("hidden private key") that is encrypted by PKI encryption that can be decrypted by the CCA 140 (eg, via a public key) Private key.

The CCS 140 may have a level of security that is considered acceptable for exchanging security information with the consumer device 120. The consuming device 120 can send a request to the CCS 140 to decrypt the hidden symmetric key. The request may include a hidden symmetric key and a hidden private key. CCS 140 may have access to an asymmetric decryption key (e.g., provided by generation device 130) to decrypt the PKI encrypted private key. CCS 140 may decrypt the hidden private key via the use of an asymmetric PKI decryption key, such as stored in a keystore of CCS 140.

After unlocking the covert private key, CCS 140 may use the (unwrapped) private key to decrypt the hidden symmetric key. After unlocking the hidden symmetric key, CCS 140 may send the (unwrapped) symmetric key to consumer device 120 in response to the request. The consumer device 120 can decrypt the encrypted data file using a symmetric key to generate a plain text file (eg, a decrypted file).

In some embodiments, CCS 140 corrupts any copies of the private key and symmetric key residing on CCS 140 after the symmetric key has been sent to consumer device 120. Accordingly, the consuming device 120 can request the CCS 140 to decrypt the hidden symmetric key required for decrypting the encrypted data archive, and the consuming device 120 can receive (decrypt) the symmetric key from the CCS 140 and decrypt the encrypted data archive. To access the decrypted data file (plain text file). After the symmetric key is sent to the consumer device 120, there is no private key Or a copy of the symmetric key remains at CCS 140.

2 is a block diagram of a system 200 in accordance with an embodiment of the present invention. System 200 includes a consumer device 204 and a cloud computing service (CCS) 206.

The consumer device 204 includes a processor 203 that includes secure session logic 232 and decryption logic 234, and the consumer device 204 also includes a dynamic random access memory (DRAM) 205. Secure session logic 232 and decryption logic 234 can be implemented in software, hardware, firmware, or a combination thereof.

CCS 206 includes transitory node 208 and may include other transitory nodes (not shown). The transitory node 208 includes a processor 210 that includes private key decryption logic 212, symmetric key decryption logic 214, and authentication logic 220. Private key decryption logic 212, symmetric key decryption logic 214, and authentication logic 220 may each be implemented in software, hardware, firmware, or a combination thereof. The temporary node 208 also includes a DRAM 216 coupled to the processor 210 for storing applications, data, and the like accessible by the processor 210.

In operation, the secure session logic 232 of the user device 202 can send a request to the consumer device 204 to open a secure session, and can include an authentication request, for example, to confirm the security level of the transient node 208. In response, the consumer device 204 can receive the authentication generated by the authentication logic 220 of the processor 210. After the authentication is received by the consumer device 204, the secure session logic 232 can establish a secure connection to the transitory node 208. The authentication may indicate the security level of the CCS 206.

After the authentication is received by the consumer device 204, the secure session logic 232 can send the request to the transitory node 208 for the encrypted data file. Declassification. The secure session logic 232 can send the encrypted data archive to the transitory node 208, such as an encrypted symmetric key (eg, a symmetric key encrypted by a private key). The secure session logic 232 can also send the covert private key to the transitory node 208, such as the private key encrypted by the public key of the CCS 206.

At the temporary node 208, the private key decryption logic 212 within the processor 210 can decrypt the private key using, for example, an asymmetric decryption key associated with CCS public encryption (eg, to decrypt the PKI encrypted private key) ). In an embodiment, the asymmetric decryption key may be retrieved by processor 210 from, for example, a key store (not shown).

After decrypting the encrypted private key, the (unencrypted) private key can be accessed by symmetric key decryption logic 214 to decrypt the encrypted symmetric key. After the symmetric key is decrypted, the processor 210 can send the symmetric key to the consumer device 204. The decryption logic 234 within the processor 203 of the consumer device 204 can decrypt the encrypted data file using a symmetric key to produce a plain text file. After transmitting the symmetric key to the consumer device 204, the processor 210 of the temporary node 208 can corrupt the symmetric key and the private key residing at the temporary node 208. After the symmetric key is sent to the consumer device 204, the secure session can end.

3 is a flow chart of a system for use in accordance with an embodiment of the present invention. The content source 302 can be a secure endpoint (eg, supporting secure key storage). The user 302 can send 310 the encrypted content archive 308 to the consumer device 304 by request 310 to decrypt the encrypted archive 308. Encrypted file 308 can include post-data that includes an encrypted symmetric key that has been encrypted using a private key. The encrypted private key may also be sent to the consumer device 304 from a content source 302 that may not support secure key storage, such as a private key encrypted using the public key of the Cloud Cipher Service (CCS) 306. .

The consuming device 304 can send the request 312 to the Cloud Cryptographic Service (CCS) 306 to decrypt the hidden symmetric key. The request may include a hidden symmetric key and a hidden private key. CCS 306 may use a PKI asymmetric private key (capable of being retrieved from a storage (eg, a keystore, not shown)) at a secure secure address of the CCS 306 (secure enclave) to the hidden private key. 314 decryption. After the covert private key is decrypted by CCS 306, the (unwrapped) private key can be used to decrypt the hidden symmetric key 316.

After decryption of the hidden symmetric key, the symmetric key 322 can be passed back to the consumer device 304. The consumer device 304, including the processor 324, can decrypt the encrypted content archive 308 to produce a decrypted content archive 326 (eg, a text-only archive). After the hidden symmetric key is unlocked, a copy of the private key retained at the secure designated address space of CCS 306 may be corrupted 318. After the symmetric key 322 is provided to the consumer device 304, the recoverable 320 remains in a copy of the symmetric key 320 at the secure designated address space of the CCS 306.

Thus, decryption of the encrypted symmetric key at the secure designated address space of CCS 306 enables the encrypted data archive to be maintained at the consumer device 304 without the need to maintain a trusted key (eg, a private key or an asymmetric PKI gold). In the case of a key), it is decrypted at the consumer device 304. A copy of the private key and symmetric key retained at CCS 306 after the symmetric key has been sent to consumer device 304 is corrupted.

4 is a flow diagram of authentication and key decryption in accordance with an embodiment of the present invention. The consumer device 402 will set up a secure session with the CCS transitory node 404 of the Cloud Cryptographic Service (CCS).

At 408, the session is opened between the consumer device 402 and the secure designated address space 406 of the transitory node 404. At 410, the security level authentication of the designated address space of the CCS temporary node 404 of the CCS is passed back to the consumer device 402. After the consumer device 402 authenticates that the temporary node 404 is authorized to receive the encrypted symmetric key for decrypting the file (eg, the security level of the designated address space of the security meets the critical level), the consumer device 402 is about to resolve The open request 412 is sent to a secure designated address space to unlock the hidden private key (eg, using the public key encrypted by the public key encryption) to generate the private key, and to unlock the encrypted symmetric key (eg, The symmetric key encrypted by the private key) to generate a symmetric key. After the decryption operation is performed, the (unwrapped) symmetric key is sent 414 to the consumer device 402. After receipt of the symmetric key, the consumer device 402 sends a command 416 to the secure designated address space 406 to close the session.

FIG. 5 is a flow diagram 500 of authentication and key decryption in accordance with another embodiment of the present invention. At 508, the consumer device 502 opens a session with the secure designated address space 506 of the transitory node 504. At 510, the security level of the specified designated address space is authenticated from the security designation. The address space 506 is sent to the consumer device 502. At 512, the consumer device 502 provides authentication of the security level of the consumer device 502 to the transitory node 504. At 514, the secure designated address space 506 assigns a security level to the consumer based on the received authentication.

After the security level is assigned and the secure session is established, the consumer device 502 checks 516 the security level of the specified address space 506 to match the security level of the hidden symmetric key, and sends the unopen request 518 to the secure The address space 506 is designated to decrypt the hidden symmetric key. The undo request 518 includes a hidden symmetric key and a hidden private key concealed using the public encryption of the CCS transitory node 504. At 520, the hidden private key (e.g., the asymmetric private key of the CCS transitory node 504) is decrypted using PKI decryption, and the hidden symmetric key is unlocked using the (unwrapped) private key. At 522, symmetric key 520 is sent to consumer device 502. At 524, the consumer device 502 closes the secure session.

6 is a block diagram of a file binary large object ("blob") 600 in accordance with an embodiment of the present invention. The archive blob 600 includes (encrypted) ciphertext 602, a hidden symmetric key 604, a covert private key 606-610, a data security level indicator 612, and a digital signature 614.

The ciphertext 602 includes data archive content that has been encrypted using a symmetric key. The symmetric key is concealed using the private key (Pr) from the generating device and stored as a hidden symmetric key 604.

The private key Pr can be encrypted by each of a plurality of public keys, each public key being associated with a different temporary node of the cloud service provider. For example, each of the public keys Tr-1, Tr-2, ... Tr-n can be Associated with the corresponding temporary node, and each public key can be used to conceal the Pr key to generate n hidden keys {Pr} Tr-i (i = 1, n). Each of the cover keys {Pr} Tr-i 606 through 610 can be stored in the archive 600. Multiple versions with a covert key {Pr} Tr-i (i = 1, n) enable any of a plurality of transitory nodes to be used to decrypt the symmetric key.

For example, the covert key {Pr}Tr-1 has been encrypted by the first public key Tr-1 associated with the first transient node of the Cloud Cipher Service (CCS, not shown). The first transitory node has access to the first asymmetric key, the first asymmetric key grants decryption of {Pr}Tr-1 to generate a private key that can be used to decrypt the hidden symmetric key {Pr }. Once unwrapped, the (unwrapped) symmetric key can be used to decrypt the encrypted data archive, for example, by sending a symmetric key to a trusted consumer that decrypts the encrypted file.

Alternatively, the first transitory node can receive the encrypted data archive and can decrypt the encrypted data archive using the (decrypted) symmetric key. Additionally, in various embodiments, the first transitory node may be able to modify (eg, edit) the content in the unencrypted data archive to perform executable content of the unencrypted data archive, presenting a file secured for the secure remote view Part of the content, etc.

In another example, the covert key {Pr}Tr-2 has been encrypted by the second public key Tr-2 associated with the second temporary node of the CCS. The second transitory node has access to a second asymmetric key that permits decryption of {Pr}Tr-2 to produce a private key that can be used to decrypt the hidden symmetric key {Pr }. Once unwrapped, the (unwrapped) symmetric key can be used, for example, by sending a symmetric key to the decryption of the encrypted file. The encrypted data file is decrypted by the consumer device.

In yet another example, as a result of multiple copies of the hidden symmetric key, the distributed execution plan can be used to schedule decryption operations on temporary node pools. For example, each of the encrypted private keys {Pr}Tr-i (i=1, n) may be able to be encrypted at the corresponding temporary node only during the corresponding time period, eg, chronological row The process can determine which of the encrypted private keys 606 through 610 will be sent to the corresponding transitory node for decryption.

The archive blob 600 can be signed using, for example, the signature key 614 of the production device such that the data security hierarchy 614 can be associated with the encrypted material and thus the blob structure may not be tampered with by post-construction. In operation, after the session between the consumer device and the transitory node is opened, the archive blob 600 can be accessed by the consumer device, for example, by establishing a security level of the security device that matches the security level of the signature 614. The ciphertext 602 can be accessed by the consumer device. The consumer device may retrieve one of the concealed symmetric key 604 and the concealed private key 606-610, and may request the concealed symmetric key 604 to be decrypted by the selected temporary node of the plurality of transitory nodes . After decrypting the symmetric key and transmitting the symmetric key to the consumer device, the copy of the private key and symmetric key remaining on the selected transitory node may be corrupted. After the encrypted data file at the consumer device is decrypted using the symmetric key, the (decrypted) data file can be passed back to the unsecured user.

FIG. 7 is a flow diagram of a method 700 for performing cloud assisted cryptography, in accordance with an embodiment of the present invention. At block 705, the Cloud Cryptographic Service (CCS) receives an invitation from the consumer device to begin a secure communication session. words. At block 710, in response to the invitation, the Cloud Cipher Service (CCS) provides security level authentication for the CCS.

Optionally, at block 720, the CCS receives the authentication of the consumer device that initiated the secure session, and the CCS assigns the security level to the consumer device. Proceeding to block 730, the transit node of the CCS receives a request from the consumer device to unlock the hidden symmetric key. With this request, the CCS transitory node receives the concealed symmetric key that has been encrypted by the private key. The CCS transitory node also receives a covert private key that has been encrypted by public key (eg, public key encryption) shared with CCS.

Proceeding to block 740, the CCS transitory node decrypts the concealed private key using the asymmetric key associated with public key encryption. Continuing to block 750, the CCS transitory node decrypts the hidden symmetric key using the (unwrapped) private key. Proceeding to block 760, the CCS transitory node sends (decrypted) the symmetric key to the consumer device to decrypt the encrypted data archive. (Alternatively, the CCS transitory node may decrypt the encrypted data file that is passed back to the consumer device.) To block 770, the CCS temporary node corrupts the copy of the private key and the copy of the symmetric key that is retained at CCS. . The method ends at 780.

Embodiments may be incorporated into other types of systems including mobile devices such as cellular phones, tablets, and the like. Referring now to Figure 8, a block diagram of a system in accordance with another embodiment of the present invention is shown. As shown in FIG. 8, system 800 can be a mobile device and can include various components. As shown in the high level view of FIG. 8, the application processor 810, which may be the central processing unit of the device, communicates with various components including the storage 815. In various embodiments, The storage 815 can include both a program and a data storage portion and can be mapped to provide secure storage.

The application processor 810 can be further coupled to an input/output system 820, which in various embodiments can include a display and one or more input devices such as a touch keypad, the touch keypad It can appear on the display when it is being executed. System 800 can also include an integrated sensor hub (ISH) 860 that can receive data from one or more sensors 870.

The application processor 810 can also be coupled to a baseband processor 830 that can adjust signals such as voice and data communications for output, as well as adjust incoming calls and other signals. As can be seen, the baseband processor 830 is coupled to the transceiver 840, which can allow both reception performance and transmission performance. Also, transceiver 840 can be in communication with antenna 850, for example, any type of antenna capable of transmitting and receiving voice and data signals via one or more communication protocols in accordance with the Institute of Electrical and Electronics Engineers 802.11 standard, via one or more communication protocols, such as via Wireless wide area networks (eg, 3G or 4G networks) and/or wireless local area networks, such as BLUETOOTH (TM) or so-called WI-FI (TM) networks. As can be seen, system 800 can further include a rechargeable power supply 825 having a rechargeable battery to allow operation in a mobile environment.

In an example, system 800 can function as a consumer device, such as consumer device 120 of system 100 of FIG. As a consumer device, system 800 can receive an encrypted data file having post-data, the post-data including an encrypted symmetric key (encrypted by a private key). The system can also receive Encrypt the private key (for example, encrypted by the PKI encrypted public key). System 800 can establish a secure session with a Cloud Cryptographic Service (CCS), for example, via authentication, and system 800 can issue a request to a CCS transitory node (not shown) of the CCS to decrypt the encrypted symmetric key. In accordance with an embodiment of the present invention, system 800 can provide an encrypted symmetric key and an encrypted private key to a CCS transitory node. The CCS transitory node may use the asymmetric key encrypted by the public key to unlock the hidden private key, and the secret key may be decrypted for decryption to the system 800 using the (unwrapped) private key. In accordance with an embodiment of the present invention, system 800 can receive a symmetric key and can decrypt the encrypted data file using a symmetric key to produce a plain text file.

Although shown in this embodiment of FIG. 8 by this particular implementation, the scope of the invention is not limited in this respect.

Other embodiments are described below.

In a first example, a system includes a cloud cryptographic server (CCS), the cloud cryptographic server (CCS) including a processor including private key decryption logic to receive one of the received from a consumer device The encrypted private key is decrypted to generate a private key. The processor also includes symmetric key decryption logic to receive the private key from the private key decryption logic and decrypt one of the encrypted symmetric keys received from the consumer device, wherein the decryption is performed using the private key . The processor also includes symmetric key decryption logic to receive the private key from the private key decryption logic and decrypt one of the encrypted symmetric keys received from the consumer device, wherein the decryption is performed using the private key . The system also includes a dynamic random access memory (DRAM) coupled to one of the processors.

In a second example of the system comprising Example 1, the encrypted private key is encrypted using one of the public key cryptography associated with the cloud cryptographic server.

In a third example comprising the system of example 1, the encrypted private key and the encrypted symmetric key are received from the consumer device in response to receipt by the consumer device via one of the encrypted files encrypted by the symmetric key receive.

In a fourth example of the system comprising Example 1, the system will establish a Trusted Execution Environment (TEE) before the encrypted private key and the encrypted symmetric key are received from the consumer device.

In a fifth example of the system comprising example 4, the establishing of the TEE includes providing a security level of authentication in response to receiving an authentication request from the consumer device.

In a sixth example of the system comprising the example 1, the processor will provide an indication of the security level of the system and the encrypted symmetric key before the encrypted symmetric key is received from the consumer device. A security level is compatible.

In a seventh example of the system comprising Example 1, after decryption of the encrypted symmetric key, the system will provide the symmetric key to the consumer device.

In an eighth example of a system comprising instance 7, the system will corrupt a copy of the private key residing in the system after the symmetric key is provided to the consumer device.

In a ninth example of the system comprising example 7, the system is Providing the symmetric key to the consumer device will corrupt a copy of the symmetric key residing in the system.

In a tenth example of the system comprising the example 1, the system will receive an encrypted file from the consumer device, using the symmetric key to decrypt an encrypted file received from the consumer device to generate an unencrypted data file, And transmitting the unencrypted data file to the consumer device.

In an eleventh example, a method includes receiving, by a cloud computing server (CCS) including at least one processor, a request to decrypt an encrypted symmetric key; receiving the encrypted symmetric key and including An encrypted private key of one of the public key encryption keys; and after decrypting the first encrypted private key, decrypting the encrypted symmetric key using the private key to generate a symmetric key .

In a twelfth example of the method comprising the method of example 11, the method includes providing the symmetric key to a consumer device.

In a thirteenth example comprising the method of example 12, the method includes destroying, by the CCS, a copy of the symmetric key present in the CCS after the symmetric key is provided to the consumer device.

In a fourteenth example comprising the method of example 12, the method includes destroying, by the CCS, a copy of the private key present in the cloud server after the symmetric key is provided to the consumer device.

In a fifteenth example comprising the method of example 11, the method includes receiving a request for a security authentication from the consumer device prior to receiving the encrypted symmetric key, and providing the security in response to the request Certification.

In a sixteenth example comprising the method of example 11, the method includes receiving a consumer device security certificate from the consumer device prior to providing the symmetric key.

In a seventeenth example comprising the method of example 15, the encrypted symmetric key is received from the consumer device only when the CCS has a security level based on the security authentication, the security level satisfies the symmetric key Associated with one of the symmetric key security levels.

The eighteenth example is an apparatus comprising the means for performing the method of any of Examples 11 to 17.

A nineteenth example is a machine readable storage body comprising machine readable instructions that, when executed, implement the method of any of embodiments 11-17.

A twentieth example is a system comprising a processor, the processor comprising secure session logic to initiate a secure communication session with a cloud cryptographic service (CCS); via the secure communication session, the pair is via a private key A request for decryption of one of the encrypted encrypted symmetric keys is provided to the CCS; the encrypted symmetric key and an encrypted private key are provided, the encrypted private key being encrypted via a public key associated with the CCS Encrypting; and receiving the symmetric key from the CCS in response to the request to decrypt the encrypted symmetric key. The system also includes a dynamic random access memory (DRAM).

The twenty-first example includes the system of example 20, and the processor further includes decryption logic to decrypt an encrypted data archive using the symmetric key to generate an unencrypted data archive.

The twenty-second example includes the system of example 20, wherein the secure session logic will provide a consumer device security authentication to the CCS prior to the establishment of the secure communication session.

The 23rd example includes the system of example 20, and wherein the secure session logic will receive a CCS security authentication from the CCS prior to the establishment of the secure communication session.

A 24th method is the method comprising initiating a secure communication session with a cloud cryptographic service (CCS) by a processor of a consumer device. The method includes encrypting a privacy request by decrypting a request for decrypting a symmetric symmetric key via the secure communication session, including encrypting one of a private key encrypted via a public key associated with the CCS. The key, and the encrypted symmetric key including the symmetric key encrypted via the private key, are provided to the CCS. The method includes receiving the symmetric key from the CCS in response to the request to decrypt the encrypted symmetric key.

The twenty-fifth example includes the method of example 24, further comprising decrypting an encrypted data file using the symmetric key to generate an unencrypted data file.

The twenty-sixth example includes the method of example 24, further comprising receiving a CCS security authentication from the CCS prior to establishment of the secure communication session.

The twenty-seventh example includes the method of example 24, further comprising providing a consumer device security authentication to the CCS prior to establishment of the secure communication session.

The 28th example is an apparatus including an execution example 24 A member of any of the methods up to 27.

The 29th example is a machine readable storage body comprising machine readable instructions that, when executed, implement the method of any of embodiments 24-27.

The 30th example is an apparatus comprising a starting component for initiating a secure communication session with one of a Cloud Cryptographic Service (CCS). The device also includes a requesting component for requesting one of decrypting an encrypted symmetric key via the secure communication session, including encrypting one of the private keys encrypted via the public key associated with the CCS The encrypted private key, and the encrypted symmetric key including the symmetric key encrypted via the private key, are provided to the CCS. The apparatus also includes a receiving component for receiving the symmetric key from the CCS in response to the request to decrypt the encrypted symmetric key.

A thirty-first example includes the apparatus of example 30, and further comprising decryption means for decrypting an encrypted data archive using the symmetric key to generate an unencrypted data archive.

The 32nd example includes the apparatus of example 30, the receiving means further for receiving a CCS security authentication from the CCS prior to establishment of the secure communication session.

The 33rd example includes the apparatus of example 30, further comprising an authentication component for providing a consumer device security authentication to the CCS prior to establishment of the secure communication session.

A 34th example is an apparatus comprising receiving means for receiving a request from a consumer device to decrypt an encrypted symmetric key. The The receiving component is further for receiving the encrypted symmetric key and an encrypted private key comprising a private key that has been encrypted by a public key. The device also includes a decryption component for decrypting the first encrypted private key to generate a private key. The decryption component is also operative to decrypt the encrypted symmetric key using the private key after decrypting the first encrypted private key to generate a symmetric key.

In a 35th example comprising the apparatus of example 34, the apparatus further comprises an output member for providing the symmetric key to the consumer device.

In a thirty-fifth example of the apparatus comprising the example 35, the apparatus further comprises means for destroying a copy of the symmetric key present in the device after the symmetric key is provided to the consumer device.

In a 37th example comprising the apparatus of example 36, the apparatus includes means for destroying a copy of the private key present in the device after the symmetric key is provided to the consumer device.

In a 38th example comprising the apparatus of example 34, the receiving means is further for receiving a request for a security authentication from the consumer device prior to receiving the encrypted symmetric key, and the apparatus further comprising responding to The authentication component of the security authentication is provided by the request.

In a 39th example comprising the apparatus of example 34, the receiving component is further for receiving a consumer device security authentication from the consumer device prior to receiving the encrypted symmetric key.

In a 40th example comprising the apparatus of example 38, the encrypted symmetric key has a security level based on the security authentication only at the CCS Received from the consumer device, the security level satisfies one of the symmetric key security levels associated with the symmetric key.

Embodiments may be implemented in code and may be stored on a non-transitory storage medium storing instructions that may be used to plan the system to execute the instructions. Storage media may include, but is not limited to, any type of disk, including floppy disks, compact discs, solid state drive (SSD), compact disc read only memory (CD-ROM), rewritable compact disc (CD-RW), and Magneto-optical disc; semiconductor devices such as read only memory (ROM), random access memory (RAM), such as dynamic random access memory (DRAM), static random access memory (SRAM), erasable and programmable Read-only memory (EPROM), flash memory, electrically erasable programmable read-only memory (EEPROM); magnetic or optical card, or any other type of media suitable for storing electronic instructions.

Although the invention has been described in connection with a limited number of embodiments, those skilled in the art will recognize many modifications and variations based on the embodiments. It is intended that the appended claims be interpreted as covering all such modifications and

200‧‧‧ system

203, 210‧‧‧ processor

204‧‧‧ consumer devices

205, 216‧‧‧ Dynamic Random Access Memory (DRAM)

206‧‧‧Cloud Computing Service (CCS)

208‧‧‧temporary nodes

212‧‧‧Private Key Decryption Logic

214‧‧‧symmetric key decryption logic

220‧‧‧Certification Logic

232‧‧‧secure session logic

234‧‧‧Decryption logic

Claims (20)

  1. An arithmetic system comprising: a processor comprising: private key decryption logic for decrypting an encrypted private key received from an consuming device for generating a private key; and a symmetric key Decryption logic for receiving the private key from the private key decryption logic and for decrypting the encrypted symmetric key received from one of the consumer devices, wherein the decryption is performed using the private key; And a dynamic random access memory (DRAM) coupled to the processor.
  2. A system as claimed in claim 1, wherein the encrypted private key is encrypted using a public key encryption.
  3. A system of claim 1, wherein the encrypted private key from the consumer device and the encrypted symmetric key are received in response to receiving, by the consumer device, one of the encrypted files encrypted with the symmetric key.
  4. The system of claim 1 wherein the system establishes a Trusted Execution Environment (TEE) prior to receiving the encrypted private key from the consumer device and the encrypted symmetric key.
  5. The system of claim 4, wherein the establishing of the TEE comprises providing a security level of authentication to the consumer device.
  6. The system of claim 1, wherein the receiving the device from the consumer device Prior to encrypting the symmetric key, the processor provides an indication of one of the security levels of the system that is compatible with one of the encrypted symmetric keys.
  7. A system as claimed in claim 1, wherein after decryption of the encrypted symmetric key, the system provides the symmetric key to the consumer device.
  8. The system of claim 7, wherein the processor corrupts a copy of the private key residing in the system after the symmetric key is provided to the consumer device.
  9. A system of claim 7, wherein the system corrupts a copy of the symmetric key residing in the system after the symmetric key is provided to the consumer device.
  10. The system of claim 1, wherein the processor is configured to: receive an encrypted file from one of the consumer devices; use the symmetric key to decrypt an encrypted file received from the consumer device to generate an unencrypted data file; And returning the unencrypted data file to the consumer device.
  11. A method for cloud assisted cryptography, comprising: receiving, by a cloud computing server (CCS) comprising at least one processor, a request from a consumer device for decrypting an encrypted symmetric key; receiving the encrypted symmetric a key and an encrypted private key containing one of the private keys that have been encrypted by a public key; decrypting the first encrypted private key to generate a private key; After decrypting the first encrypted private key, the encrypted symmetric key is decrypted using the private key to generate a symmetric key.
  12. The method of claim 11, further comprising providing the symmetric key to the consumer device.
  13. The method of claim 12, further comprising, after the symmetric key is provided to the consumer device, destroying, by the CCS, a copy of the symmetric key present in the CCS.
  14. The method of claim 12, further comprising, after the symmetric key is provided to the consumer device, destroying, by the CCS, a copy of the private key present in the cloud server.
  15. The method of claim 11, further comprising receiving a request from the consumer for a security authentication prior to receiving the encrypted symmetric key, and providing the security authentication in response to the request.
  16. The method of claim 11, further comprising receiving a consumer device security certificate from the consumer device prior to receiving the encrypted symmetric key.
  17. The method of claim 15, wherein the encrypted from the consumer device is received only when the CCS has a security level that satisfies one of the symmetric key security levels associated with the symmetric key based on the security authentication Symmetric key.
  18. An arithmetic system, comprising: a processor, comprising: secure session logic, configured to: initiate a secure connection with a cloud cryptographic service (CCS) a session via which a request to decrypt an encrypted symmetric key encrypted via a private key, the encrypted symmetric key, and including encryption via a public key associated with the CCS is encrypted One of the private keys is provided to the CCS via an encrypted private key; and receives the symmetric key from the CCS in response to the request to decrypt the encrypted symmetric key; and a dynamic random access memory (DRAM) .
  19. The system of claim 18, wherein the processor further comprises decryption logic for decrypting an encrypted data file using the symmetric key to generate an unencrypted data file.
  20. The system of claim 18, wherein the secure session logic is to provide a consumer device security authentication to the CCS prior to the establishment of the secure communication session.
TW104104390A 2014-03-27 2015-02-10 Method and apparatus for cloud-assisted cryptography TWI601405B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/227,319 US9503433B2 (en) 2014-03-27 2014-03-27 Method and apparatus for cloud-assisted cryptography

Publications (2)

Publication Number Publication Date
TW201541923A TW201541923A (en) 2015-11-01
TWI601405B true TWI601405B (en) 2017-10-01

Family

ID=54191993

Family Applications (1)

Application Number Title Priority Date Filing Date
TW104104390A TWI601405B (en) 2014-03-27 2015-02-10 Method and apparatus for cloud-assisted cryptography

Country Status (6)

Country Link
US (1) US9503433B2 (en)
EP (1) EP3123657B1 (en)
KR (1) KR101894232B1 (en)
CN (1) CN106063183B (en)
TW (1) TWI601405B (en)
WO (1) WO2015148884A1 (en)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8949818B2 (en) * 2012-06-29 2015-02-03 Intel Corporation Mechanism for facilitating dynamic and trusted cloud-based extension upgrades for computing systems
US10298555B2 (en) * 2014-04-04 2019-05-21 Zettaset, Inc. Securing files under the semi-trusted user threat model using per-file key encryption
US10043029B2 (en) * 2014-04-04 2018-08-07 Zettaset, Inc. Cloud storage encryption
US10303879B1 (en) * 2014-11-06 2019-05-28 Amazon Technologies, Inc. Multi-tenant trusted platform modules
EP3032453B1 (en) * 2014-12-08 2019-11-13 eperi GmbH Storing data in a server computer with deployable encryption/decryption infrastructure
US9921976B2 (en) 2015-03-25 2018-03-20 Vera Access files
US20170034214A1 (en) * 2015-07-30 2017-02-02 Northrop Grumman Systems Corporation Apparatus and method for cross enclave information control
US10594668B1 (en) 2016-12-01 2020-03-17 Thales Esecurity, Inc. Crypto Cloudlets
WO2019219181A1 (en) * 2018-05-16 2019-11-21 Telefonaktiebolaget Lm Ericsson (Publ) Enclave population

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110289310A1 (en) * 2010-05-20 2011-11-24 Selgas Thomas D Cloud computing appliance
US20110296201A1 (en) * 2010-05-27 2011-12-01 Pere Monclus Method and apparatus for trusted execution in infrastructure as a service cloud environments
US8239917B2 (en) * 2002-10-16 2012-08-07 Enterprise Information Management, Inc. Systems and methods for enterprise security with collaborative peer to peer architecture
US20140050317A1 (en) * 2012-08-16 2014-02-20 Digicert, Inc. Cloud Key Management System

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2318486B (en) * 1996-10-16 2001-03-28 Ibm Data communications system
US6098056A (en) * 1997-11-24 2000-08-01 International Business Machines Corporation System and method for controlling access rights to and security of digital content in a distributed information system, e.g., Internet
US7480806B2 (en) * 2002-02-22 2009-01-20 Intel Corporation Multi-token seal and unseal
AT346447T (en) * 2003-02-28 2006-12-15 Research In Motion Ltd System and method for protecting data in a communication device
US8074083B1 (en) * 2007-01-09 2011-12-06 Google Inc. Controlling download and playback of media content
KR100888075B1 (en) * 2008-04-28 2009-03-11 인하대학교 산학협력단 An encryption and decryption system for multicast using a personal symmetric key
US8213618B2 (en) * 2008-12-30 2012-07-03 Intel Corporation Protecting content on client platforms
KR20130021774A (en) * 2011-08-23 2013-03-06 주식회사 스마트솔루션 Method for providing security service based on digital certificate and system for providing security service based on digital certificate
CN102546181B (en) * 2012-01-09 2014-12-17 西安电子科技大学 Cloud storage encrypting and deciphering method based on secret key pool
US20130191629A1 (en) * 2012-01-19 2013-07-25 Laconic Security, Llc Secure group-based data storage in the cloud
US9059972B2 (en) * 2012-07-03 2015-06-16 International Business Machines Corporation Issuing, presenting and challenging mobile device identification documents
US9436940B2 (en) * 2012-07-09 2016-09-06 Maxim Integrated Products, Inc. Embedded secure element for authentication, storage and transaction within a mobile terminal
US20140019753A1 (en) 2012-07-10 2014-01-16 John Houston Lowry Cloud key management
US20140082364A1 (en) 2012-09-18 2014-03-20 Tommaso Cucinotta Collaborative Uses of a Cloud Computing Confidential Domain of Execution
EP2939363A1 (en) * 2012-12-28 2015-11-04 Vasco Data Security International GmbH Remote authentication and transaction signatures
US9009469B2 (en) * 2013-01-15 2015-04-14 Sap Se Systems and methods for securing data in a cloud computing environment using in-memory techniques and secret key encryption
CN105474677B (en) * 2013-09-19 2019-04-23 英特尔公司 The position of safety management and follow-up service access
US9246676B2 (en) * 2013-11-22 2016-01-26 Cisco Technology, Inc. Secure access for encrypted data

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8239917B2 (en) * 2002-10-16 2012-08-07 Enterprise Information Management, Inc. Systems and methods for enterprise security with collaborative peer to peer architecture
US20110289310A1 (en) * 2010-05-20 2011-11-24 Selgas Thomas D Cloud computing appliance
US20110296201A1 (en) * 2010-05-27 2011-12-01 Pere Monclus Method and apparatus for trusted execution in infrastructure as a service cloud environments
US20140050317A1 (en) * 2012-08-16 2014-02-20 Digicert, Inc. Cloud Key Management System

Also Published As

Publication number Publication date
US9503433B2 (en) 2016-11-22
EP3123657A1 (en) 2017-02-01
TW201541923A (en) 2015-11-01
WO2015148884A1 (en) 2015-10-01
KR101894232B1 (en) 2018-09-04
KR20160113264A (en) 2016-09-28
CN106063183A (en) 2016-10-26
EP3123657B1 (en) 2019-08-28
CN106063183B (en) 2020-05-05
US20150281189A1 (en) 2015-10-01
EP3123657A4 (en) 2017-11-22

Similar Documents

Publication Publication Date Title
US10097544B2 (en) Protection and verification of user authentication credentials against server compromise
EP3140950B1 (en) Secure transport of encrypted virtual machines with continuous owner access
US9680654B2 (en) Systems and methods for validated secure data access based on an endorsement provided by a trusted third party
US9465947B2 (en) System and method for encryption and key management in cloud storage
TWI515601B (en) Electronic device, method for establishing and enforcing a security policy associated with anaccess control element, and secure element
US9912645B2 (en) Methods and apparatus to securely share data
US9578021B2 (en) Methods and systems for distributing cryptographic data to authenticated recipients
US9210133B2 (en) Method and system of providing authentication of user access to a computer resource via a mobile device using multiple separate security factors
KR101722631B1 (en) Secured access to resources using a proxy
US9609024B2 (en) Method and system for policy based authentication
US9602549B2 (en) Establishing trust between applications on a computer
US9258122B1 (en) Systems and methods for securing data at third-party storage services
US9674182B2 (en) Systems and methods for distributed trust computing and key management
EP3195555B1 (en) Secure key management for roaming protected content
US20190089527A1 (en) System and method of enforcing a computer policy
US9514317B2 (en) Policy-based trusted inspection of rights managed content
US9363241B2 (en) Cryptographic enforcement based on mutual attestation for cloud services
US9805210B2 (en) Encryption-based data access management
KR101712784B1 (en) System and method for key management for issuer security domain using global platform specifications
US20160004885A1 (en) Securing Encrypted Virtual Hard Disks
US8639928B2 (en) System and method for mounting encrypted data based on availability of a key on a network
US9246678B2 (en) Secure cloud storage and encryption management system
Chandramouli et al. Cryptographic key management issues and challenges in cloud services
US8625802B2 (en) Methods, devices, and media for secure key management in a non-secured, distributed, virtualized environment with applications to cloud-computing security and management
EP2798777B1 (en) Method and system for distributed off-line logon using one-time passwords